@eve-horizon/cli 0.2.9 → 0.2.10

package/README.md

@@ -6,18 +6,38 @@ Published CLI (npx) for interacting with the Eve Horizon API. Dev/ops tooling li
 npx @eve/cli --help
 ```
 
+## Local Development & Global Parity
+
+When testing CLI changes locally, you have two options:
+
+```bash
+# Option 1: run the repo-local build directly
+pnpm -C packages/cli build
+node packages/cli/bin/eve.js --help
+
+# Option 2: link the CLI so the global `eve` binary matches your local build
+pnpm -C packages/cli build
+cd packages/cli && npm link
+eve --help
+```
+
+To update global installs for others, publish a new CLI version via the `cli-v*` tag flow
+(see root AGENTS.md for release instructions).
+
 ## Philosophy
 
 The CLI is the **primary interface** for Eve Horizon, designed for humans and AI agents. The REST API is the substrate: every operation is exposed via HTTP, and the CLI is a thin wrapper that handles argument parsing and output formatting. It does not bypass the API or contain business logic.
 
 See [API Philosophy](../../docs/system/api-philosophy.md) and [OpenAPI](../../docs/system/openapi.md).
 
-## Profiles (defaults + credentials)
+## Profiles (repo-local defaults)
 
 Profiles store API URL, default org/project IDs, default harness, and Supabase auth config.
+Profiles are **repo-local** and live in `.eve/profile.yaml` so each project keeps its own
+defaults without impacting other checkouts.
 
 ```bash
-# Create or update a profile
+# Create or update a profile (repo-local)
 eve profile set local \
   --api-url http://localhost:4801 \
   --org org_defaulttestorg \
@@ -27,7 +47,7 @@ eve profile set local \
 eve profile set --harness mclaude
 eve profile set --harness mclaude:fast   # harness with variant
 
-# Set active profile
+# Set active profile (repo-local)
 eve profile use local
 
 # Show active profile
@@ -54,12 +74,16 @@ eve profile set prod \
 Auth is **required** for cloud stacks. The default flow uses GitHub SSH keys; Supabase remains an
 optional adapter for legacy deployments.
 
-The CLI will refresh Supabase access tokens automatically if a refresh token is available.
+Credentials are stored globally in `~/.eve/credentials.json`, keyed by API URL. The CLI will
+refresh Supabase access tokens automatically if a refresh token is available.
 
 ```bash
 # SSH login (default)
 eve auth login --email you@example.com --ssh-key ~/.ssh/id_ed25519
 
+# SSH login with custom token TTL (1-90 days)
+eve auth login --email you@example.com --ttl 30
+
 # Supabase login (optional)
 eve auth login --email you@example.com --password '...' \
   --supabase-url https://your-project.supabase.co \

package/dist/commands/auth.js

@@ -59,6 +59,11 @@ async function handleAuth(subcommand, flags, context, credentials) {
             const email = (0, args_1.getStringFlag)(flags, ['email']) ?? process.env.EVE_AUTH_EMAIL ?? context.profile.default_email;
             const userId = (0, args_1.getStringFlag)(flags, ['user-id']);
             const password = (0, args_1.getStringFlag)(flags, ['password']) ?? process.env.EVE_AUTH_PASSWORD;
+            const ttlStr = (0, args_1.getStringFlag)(flags, ['ttl']);
+            const ttlDays = ttlStr ? parseInt(ttlStr, 10) : undefined;
+            if (ttlDays !== undefined && (isNaN(ttlDays) || ttlDays < 1 || ttlDays > 90)) {
+                throw new Error('--ttl must be between 1 and 90 days');
+            }
             const supabaseUrl = (0, args_1.getStringFlag)(flags, ['supabase-url']) ||
                 process.env.EVE_SUPABASE_URL ||
                 context.profile.supabase_url;
@@ -102,7 +107,7 @@ async function handleAuth(subcommand, flags, context, credentials) {
                 const expiresAt = payload.expires_in
                     ? Math.floor(Date.now() / 1000) + payload.expires_in
                     : undefined;
-                credentials.profiles[context.profileName] = {
+                credentials.tokens[context.authKey] = {
                     access_token: payload.access_token,
                     refresh_token: payload.refresh_token,
                     expires_at: expiresAt,
@@ -116,7 +121,7 @@ async function handleAuth(subcommand, flags, context, credentials) {
                 throw new Error('Usage: eve auth login --email <email> or --user-id <id>');
             }
             // Attempt SSH key login with GitHub key auto-discovery on failure
-            const loginResult = await attemptSshLogin(context, credentials, flags, email, userId);
+            const loginResult = await attemptSshLogin(context, credentials, flags, email, userId, ttlDays);
             if (loginResult.success) {
                 (0, output_1.outputJson)({ profile: context.profileName, token_type: loginResult.tokenType }, json, '✓ Logged in');
                 return;
@@ -136,7 +141,7 @@ async function handleAuth(subcommand, flags, context, credentials) {
             }
             // Retry login after key registration
             console.log('\nRetrying login with registered keys...');
-            const retryResult = await attemptSshLogin(context, credentials, flags, email, userId);
+            const retryResult = await attemptSshLogin(context, credentials, flags, email, userId, ttlDays);
             if (retryResult.success) {
                 (0, output_1.outputJson)({ profile: context.profileName, token_type: retryResult.tokenType }, json, '✓ Logged in');
                 return;
@@ -144,8 +149,14 @@ async function handleAuth(subcommand, flags, context, credentials) {
             throw new Error(retryResult.error ?? 'Auth verify failed after key registration');
         }
         case 'logout': {
-            if (credentials.profiles[context.profileName]) {
+            const hadToken = Boolean(credentials.tokens[context.authKey] || credentials.profiles?.[context.profileName]);
+            if (credentials.tokens[context.authKey]) {
+                delete credentials.tokens[context.authKey];
+            }
+            if (credentials.profiles?.[context.profileName]) {
                 delete credentials.profiles[context.profileName];
+            }
+            if (hadToken) {
                 (0, config_1.saveCredentials)(credentials);
             }
             (0, output_1.outputJson)({ profile: context.profileName }, json, '✓ Logged out');
@@ -251,7 +262,7 @@ async function handleAuth(subcommand, flags, context, credentials) {
             if (!payload.access_token) {
                 throw new Error('Bootstrap response missing access_token');
             }
-            credentials.profiles[context.profileName] = {
+            credentials.tokens[context.authKey] = {
                 access_token: payload.access_token,
                 expires_at: payload.expires_at,
                 token_type: payload.token_type,
@@ -262,7 +273,7 @@ async function handleAuth(subcommand, flags, context, credentials) {
         }
         case 'token': {
             // Print the current access token to stdout for use in scripts
-            const tokenEntry = credentials.profiles[context.profileName];
+            const tokenEntry = credentials.tokens[context.authKey] || credentials.profiles?.[context.profileName];
             if (!tokenEntry || !tokenEntry.access_token) {
                 console.error('No valid token found. Please login first with: eve auth login');
                 process.exit(1);
@@ -691,7 +702,7 @@ function signNonceWithSsh(keyPath, nonce) {
         (0, node_fs_1.rmSync)(tempDir, { recursive: true, force: true });
     }
 }
-async function attemptSshLogin(context, credentials, flags, email, userId) {
+async function attemptSshLogin(context, credentials, flags, email, userId, ttlDays) {
     const challengeResponse = await (0, client_1.requestRaw)(context, '/auth/challenge', {
         method: 'POST',
         body: {
@@ -723,7 +734,7 @@ async function attemptSshLogin(context, credentials, flags, email, userId) {
     }
     const verifyResponse = await (0, client_1.requestRaw)(context, '/auth/verify', {
         method: 'POST',
-        body: { challenge_id: challenge.challenge_id, signature },
+        body: { challenge_id: challenge.challenge_id, signature, ...(ttlDays !== undefined && { ttl_days: ttlDays }) },
     });
     if (!verifyResponse.ok) {
         const message = typeof verifyResponse.data === 'string'
@@ -735,7 +746,7 @@ async function attemptSshLogin(context, credentials, flags, email, userId) {
     if (!payload.access_token) {
         return { success: false, error: 'Auth verify response missing access_token' };
     }
-    credentials.profiles[context.profileName] = {
+    credentials.tokens[context.authKey] = {
         access_token: payload.access_token,
         expires_at: payload.expires_at,
         token_type: payload.token_type,

package/dist/commands/build.js

@@ -4,7 +4,7 @@ exports.handleBuild = handleBuild;
 const args_1 = require("../lib/args");
 const client_1 = require("../lib/client");
 const output_1 = require("../lib/output");
-const node_child_process_1 = require("node:child_process");
+const git_js_1 = require("../lib/git.js");
 const ERROR_CODES = {
     auth_error: { code: 'auth_error', label: 'Authentication Error', hint: "Check GITHUB_TOKEN via 'eve secrets set'" },
     clone_error: { code: 'clone_error', label: 'Git Clone Error', hint: "Verify repo URL and access. Check 'eve secrets list'" },
@@ -63,23 +63,14 @@ async function handleCreate(flags, context, json) {
     const ref = (0, args_1.getStringFlag)(flags, ['ref']);
     const manifestHash = (0, args_1.getStringFlag)(flags, ['manifest-hash', 'manifest']);
     const services = (0, args_1.getStringFlag)(flags, ['services']);
+    const repoDir = (0, args_1.getStringFlag)(flags, ['repo-dir', 'repo_dir', 'dir']);
     if (!projectId || !ref || !manifestHash) {
-        throw new Error('Usage: eve build create --project <id> --ref <sha> --manifest-hash <hash> [--services <s1,s2>]');
+        throw new Error('Usage: eve build create --project <id> --ref <sha> --manifest-hash <hash> [--services <s1,s2>] [--repo-dir <path>]');
     }
     // Resolve git ref to actual 40-char SHA
-    let gitSha;
-    try {
-        gitSha = (0, node_child_process_1.execSync)(`git rev-parse ${ref}`, {
-            encoding: 'utf-8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
-        if (!json) {
-            console.log(`Resolved ref '${ref}' → ${gitSha.substring(0, 8)}...`);
-        }
-    }
-    catch (error) {
-        throw new Error(`Failed to resolve git ref '${ref}': ${error instanceof Error ? error.message : String(error)}\n` +
-            'Make sure you are in a git repository and the ref exists.');
+    const gitSha = await (0, git_js_1.resolveGitRef)(context, projectId, ref, repoDir);
+    if (!json && ref !== gitSha) {
+        console.log(`Resolved ref '${ref}' → ${gitSha.substring(0, 8)}...`);
     }
     const body = { git_sha: gitSha, manifest_hash: manifestHash };
     if (services) {

package/dist/commands/env.js

@@ -37,7 +37,7 @@ exports.handleEnv = handleEnv;
 const args_1 = require("../lib/args");
 const client_1 = require("../lib/client");
 const output_1 = require("../lib/output");
-const child_process_1 = require("child_process");
+const git_js_1 = require("../lib/git.js");
 const readline = __importStar(require("node:readline/promises"));
 // ============================================================================
 // Main Handler
@@ -64,7 +64,7 @@ async function handleEnv(subcommand, positionals, flags, context) {
                 '  list [project]                          - list environments for a project\n' +
                 '  show <project> <name>                   - show details of an environment\n' +
                 '  create <name> --type=<type> [options]   - create an environment\n' +
-                '  deploy <env> --ref <sha> [--direct] [--inputs <json>]   - deploy to an environment\n' +
+                '  deploy <env> --ref <sha> [--direct] [--inputs <json>] [--repo-dir <path>]   - deploy to an environment\n' +
                 '  logs <project> <env> <service> [--since <seconds>] [--tail <n>] [--grep <text>] - get service logs\n' +
                 '  diagnose <project> <env>                - diagnose deployment health and events\n' +
                 '  delete <name> [--project=<id>] [--force] - delete an environment');
@@ -194,27 +194,18 @@ async function handleDeploy(positionals, flags, context, json) {
         envName = flagName;
     }
     if (!projectId || !envName) {
-        throw new Error('Usage: eve env deploy <env> --ref <sha> [--direct] [--inputs <json>] [--image-tag <tag>] [--project=<id>]');
+        throw new Error('Usage: eve env deploy <env> --ref <sha> [--direct] [--inputs <json>] [--image-tag <tag>] [--repo-dir <path>] [--project=<id>]');
     }
     // --ref flag is now required
     const ref = (0, args_1.getStringFlag)(flags, ['ref']);
     if (!ref) {
         throw new Error('Usage: eve env deploy <env> --ref <sha> [options]\n\nThe --ref flag is required (git SHA or commit reference)');
     }
+    const repoDir = (0, args_1.getStringFlag)(flags, ['repo-dir', 'repo_dir', 'dir']);
     // Resolve git ref to actual 40-char SHA
-    let gitSha;
-    try {
-        gitSha = (0, child_process_1.execSync)(`git rev-parse ${ref}`, {
-            encoding: 'utf-8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
-        if (!json) {
-            console.log(`Resolved ref '${ref}' → ${gitSha.substring(0, 8)}...`);
-        }
-    }
-    catch (error) {
-        throw new Error(`Failed to resolve git ref '${ref}': ${error instanceof Error ? error.message : String(error)}\n` +
-            'Make sure you are in a git repository and the ref exists.');
+    const gitSha = await (0, git_js_1.resolveGitRef)(context, projectId, ref, repoDir);
+    if (!json && ref !== gitSha) {
+        console.log(`Resolved ref '${ref}' → ${gitSha.substring(0, 8)}...`);
     }
     if (!json) {
         console.log(`Deploying commit ${gitSha.substring(0, 8)} to ${envName}...`);
@@ -434,21 +425,6 @@ function buildQuery(params) {
     const query = search.toString();
     return query ? `?${query}` : '';
 }
-/**
- * Get current git SHA from working directory
- */
-function getGitSha() {
-    try {
-        const sha = (0, child_process_1.execSync)('git rev-parse HEAD', {
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
-        return sha;
-    }
-    catch {
-        return null;
-    }
-}
 /**
  * Format environments as a human-readable table
  */

package/dist/commands/pipeline.js

@@ -4,7 +4,7 @@ exports.handlePipeline = handlePipeline;
 const args_1 = require("../lib/args");
 const client_1 = require("../lib/client");
 const output_1 = require("../lib/output");
-const node_child_process_1 = require("node:child_process");
+const git_js_1 = require("../lib/git.js");
 async function handlePipeline(subcommand, positionals, flags, context) {
     const json = Boolean(flags.json);
     switch (subcommand) {
@@ -182,23 +182,14 @@ async function handleRun(positionals, flags, context, json) {
     const wait = Boolean(flags.wait);
     const timeout = (0, args_1.getStringFlag)(flags, ['timeout']);
     const inputsRaw = (0, args_1.getStringFlag)(flags, ['inputs']);
+    const repoDir = (0, args_1.getStringFlag)(flags, ['repo-dir', 'repo_dir', 'dir']);
     if (!pipelineName || !projectId || !ref) {
-        throw new Error('Usage: eve pipeline run <name> --ref <sha> [--env <env>] [--project <id>] [--wait] [--inputs <json>] [--only <step>]');
+        throw new Error('Usage: eve pipeline run <name> --ref <sha> [--env <env>] [--project <id>] [--repo-dir <path>] [--wait] [--inputs <json>] [--only <step>]');
     }
     // Resolve git ref to actual 40-char SHA
-    let gitSha;
-    try {
-        gitSha = (0, node_child_process_1.execSync)(`git rev-parse ${ref}`, {
-            encoding: 'utf-8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-        }).trim();
-        if (!json) {
-            console.log(`Resolved ref '${ref}' → ${gitSha.substring(0, 8)}...`);
-        }
-    }
-    catch (error) {
-        throw new Error(`Failed to resolve git ref '${ref}': ${error instanceof Error ? error.message : String(error)}\n` +
-            'Make sure you are in a git repository and the ref exists.');
+    const gitSha = await (0, git_js_1.resolveGitRef)(context, projectId, ref, repoDir);
+    if (!json && ref !== gitSha) {
+        console.log(`Resolved ref '${ref}' → ${gitSha.substring(0, 8)}...`);
     }
     let inputs;
     if (inputsRaw) {

package/dist/commands/profile.js

@@ -1,76 +1,46 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.handleProfile = handleProfile;
-const config_1 = require("../lib/config");
 const context_1 = require("../lib/context");
 const output_1 = require("../lib/output");
-function handleProfile(subcommand, positionals, flags, config) {
+function handleProfile(subcommand, positionals, flags) {
     const json = Boolean(flags.json);
+    if (flags.global) {
+        throw new Error('Global profiles have been removed. Profiles are repo-local; remove --global.');
+    }
     switch (subcommand) {
         case 'list': {
-            const repoProfile = (0, context_1.loadRepoProfile)();
-            const localProfileName = repoProfile?.profile;
-            const profiles = Object.entries(config.profiles).map(([name, profile]) => ({
+            const repoProfiles = (0, context_1.loadRepoProfiles)();
+            const profiles = Object.entries(repoProfiles.profiles).map(([name, profile]) => ({
                 name,
-                active: name === config.active_profile,
-                local: name === localProfileName,
+                active: name === repoProfiles.activeProfile,
                 ...profile,
             }));
-            (0, output_1.outputJson)({
-                active_profile: config.active_profile,
-                local_profile: localProfileName ?? null,
-                profiles,
-            }, json);
+            (0, output_1.outputJson)({ active_profile: repoProfiles.activeProfile ?? null, profiles }, json);
             return;
         }
         case 'show': {
-            // Check for local profile first
-            const repoProfile = (0, context_1.loadRepoProfile)();
-            const localProfileName = repoProfile?.profile;
-            // Determine which profile to show
             const requestedName = positionals[0];
-            let name;
-            let source;
-            if (requestedName) {
-                // Explicit name requested
-                name = requestedName;
-                source = localProfileName === requestedName ? 'local' : 'global';
-            }
-            else if (localProfileName) {
-                // No name specified, use local profile if exists
-                name = localProfileName;
-                source = 'local';
-            }
-            else {
-                // Fall back to global active profile
-                name = config.active_profile;
-                source = 'global';
+            const repoProfiles = (0, context_1.loadRepoProfiles)();
+            const name = resolveProfileName(repoProfiles, requestedName);
+            if (!name) {
+                throw new Error('No local profiles configured. Use `eve profile set` to create one.');
             }
-            const profile = config.profiles[name];
+            const profile = repoProfiles.profiles[name];
             if (!profile) {
                 throw new Error(`Profile ${name} not found`);
             }
-            // Merge local overrides if showing local profile
-            const effectiveProfile = source === 'local' && repoProfile
-                ? {
-                    ...profile,
-                    ...(repoProfile.api_url && { api_url: repoProfile.api_url }),
-                    ...(repoProfile.org_id && { org_id: repoProfile.org_id }),
-                    ...(repoProfile.project_id && { project_id: repoProfile.project_id }),
-                }
-                : profile;
-            const sourceLabel = source === 'local' ? ` (local: .eve/profile.yaml)` : ' (global)';
-            (0, output_1.outputJson)({ name, source, ...effectiveProfile }, json, `${name}${sourceLabel}`);
+            const active = repoProfiles.activeProfile === name;
+            (0, output_1.outputJson)({ name, active, ...profile }, json, `${name} (local)`);
             return;
         }
         case 'use': {
-            const isGlobal = Boolean(flags.global);
             const isClear = Boolean(flags.clear);
             // Handle --clear: remove local profile
             if (isClear) {
                 const removed = (0, context_1.removeRepoProfile)();
                 if (removed) {
-                    (0, output_1.outputJson)({ cleared: true, path: (0, context_1.getRepoProfilePath)() }, json, `✓ Removed local profile`);
+                    (0, output_1.outputJson)({ cleared: true, path: (0, context_1.getRepoProfilePath)() }, json, `✓ Removed local profile store (${(0, context_1.getRepoProfilePath)()})`);
                 }
                 else {
                     (0, output_1.outputJson)({ cleared: false }, json, `No local profile to remove`);
@@ -79,32 +49,16 @@ function handleProfile(subcommand, positionals, flags, config) {
             }
             const name = positionals[0];
             if (!name) {
-                throw new Error('Usage: eve profile use <name> [--global]');
-            }
-            // Validate profile exists in global config (auto-create if needed)
-            if (!config.profiles[name]) {
-                config.profiles[name] = {};
-                (0, config_1.saveConfig)(config);
+                throw new Error('Usage: eve profile use <name>');
             }
-            if (isGlobal) {
-                // Explicit: set global active profile in ~/.eve/config.json
-                config.active_profile = name;
-                (0, config_1.saveConfig)(config);
-                (0, output_1.outputJson)({ active_profile: name }, json, `✓ Active profile: ${name} (global)`);
-            }
-            else {
-                // Default: write to .eve/profile.yaml (local project mode)
-                const repoProfile = { profile: name };
-                // Apply any override flags
-                if (typeof flags['api-url'] === 'string')
-                    repoProfile.api_url = flags['api-url'];
-                if (typeof flags.org === 'string')
-                    repoProfile.org_id = flags.org;
-                if (typeof flags.project === 'string')
-                    repoProfile.project_id = flags.project;
-                (0, context_1.saveRepoProfile)(repoProfile);
-                (0, output_1.outputJson)({ profile: name, local: true, path: (0, context_1.getRepoProfilePath)(), ...repoProfile }, json, `✓ Local profile set: ${name} (${(0, context_1.getRepoProfilePath)()})`);
+            const repoProfiles = (0, context_1.loadRepoProfiles)();
+            if (!repoProfiles.profiles[name]) {
+                repoProfiles.profiles[name] = {};
             }
+            repoProfiles.profiles[name] = applyProfileFlags(repoProfiles.profiles[name], flags);
+            repoProfiles.activeProfile = name;
+            (0, context_1.saveRepoProfiles)(repoProfiles);
+            (0, output_1.outputJson)({ active_profile: name, path: (0, context_1.getRepoProfilePath)(), ...repoProfiles.profiles[name] }, json, `✓ Active profile: ${name} (${(0, context_1.getRepoProfilePath)()})`);
             return;
         }
         case 'create': {
@@ -112,51 +66,28 @@ function handleProfile(subcommand, positionals, flags, config) {
             if (!name) {
                 throw new Error('Usage: eve profile create <name> [--api-url <url> ...]');
             }
-            if (config.profiles[name]) {
+            const repoProfiles = (0, context_1.loadRepoProfiles)();
+            if (repoProfiles.profiles[name]) {
                 throw new Error(`Profile ${name} already exists`);
             }
-            config.profiles[name] = applyProfileFlags({}, flags);
-            (0, config_1.saveConfig)(config);
-            (0, output_1.outputJson)({ name, ...config.profiles[name] }, json, `✓ Profile created: ${name}`);
+            repoProfiles.profiles[name] = applyProfileFlags({}, flags);
+            if (!repoProfiles.activeProfile) {
+                repoProfiles.activeProfile = name;
+            }
+            (0, context_1.saveRepoProfiles)(repoProfiles);
+            (0, output_1.outputJson)({ name, ...repoProfiles.profiles[name] }, json, `✓ Profile created: ${name}`);
             return;
         }
         case 'set': {
-            const isGlobal = Boolean(flags.global);
-            if (isGlobal) {
-                // Explicit: write to global ~/.eve/config.json
-                const name = positionals[0] ?? config.active_profile;
-                if (!config.profiles[name]) {
-                    config.profiles[name] = {};
-                }
-                config.profiles[name] = applyProfileFlags(config.profiles[name], flags);
-                config.active_profile = name;
-                (0, config_1.saveConfig)(config);
-                (0, output_1.outputJson)({ active_profile: name, ...config.profiles[name] }, json, `✓ Profile set: ${name} (global)`);
-            }
-            else {
-                // Default: write to local .eve/profile.yaml
-                const globalOnlyFields = ['supabase-url', 'supabase-anon-key', 'default-email', 'default-ssh-key'];
-                const usedGlobalFields = globalOnlyFields.filter(f => typeof flags[f] === 'string');
-                if (usedGlobalFields.length > 0) {
-                    throw new Error(`${usedGlobalFields.map(f => `--${f}`).join(', ')} are user-level settings.\n` +
-                        `Use --global to write them to ~/.eve/config.json`);
-                }
-                const existing = (0, context_1.loadRepoProfile)() ?? {};
-                const repoProfile = { ...existing };
-                const name = positionals[0];
-                if (name)
-                    repoProfile.profile = name;
-                if (typeof flags['api-url'] === 'string')
-                    repoProfile.api_url = flags['api-url'];
-                if (typeof flags.org === 'string')
-                    repoProfile.org_id = flags.org;
-                if (typeof flags.project === 'string')
-                    repoProfile.project_id = flags.project;
-                if (typeof flags.harness === 'string')
-                    repoProfile.default_harness = flags.harness;
-                (0, context_1.saveRepoProfile)(repoProfile);
-                (0, output_1.outputJson)({ ...repoProfile, path: (0, context_1.getRepoProfilePath)() }, json, `✓ Profile set: ${repoProfile.profile ?? 'local'} (${(0, context_1.getRepoProfilePath)()})`);
-            }
+            const repoProfiles = (0, context_1.loadRepoProfiles)();
+            const name = resolveProfileName(repoProfiles, positionals[0]) ?? 'default';
+            if (!repoProfiles.profiles[name]) {
+                repoProfiles.profiles[name] = {};
+            }
+            repoProfiles.profiles[name] = applyProfileFlags(repoProfiles.profiles[name], flags);
+            repoProfiles.activeProfile = name;
+            (0, context_1.saveRepoProfiles)(repoProfiles);
+            (0, output_1.outputJson)({ active_profile: name, ...repoProfiles.profiles[name], path: (0, context_1.getRepoProfilePath)() }, json, `✓ Profile set: ${name} (${(0, context_1.getRepoProfilePath)()})`);
             return;
         }
         case 'remove': {
@@ -164,19 +95,22 @@ function handleProfile(subcommand, positionals, flags, config) {
             if (!name) {
                 throw new Error('Usage: eve profile remove <name>');
             }
-            if (!config.profiles[name]) {
+            const repoProfiles = (0, context_1.loadRepoProfiles)();
+            if (!repoProfiles.profiles[name]) {
                 throw new Error(`Profile ${name} not found`);
             }
-            delete config.profiles[name];
-            if (config.active_profile === name) {
-                const [first] = Object.keys(config.profiles);
-                config.active_profile = first ?? 'default';
-                if (!config.profiles[config.active_profile]) {
-                    config.profiles[config.active_profile] = {};
-                }
+            delete repoProfiles.profiles[name];
+            if (repoProfiles.activeProfile === name) {
+                const [first] = Object.keys(repoProfiles.profiles);
+                repoProfiles.activeProfile = first;
+            }
+            if (!repoProfiles.activeProfile && Object.keys(repoProfiles.profiles).length === 0) {
+                (0, context_1.removeRepoProfile)();
+                (0, output_1.outputJson)({ removed: name, cleared: true }, json, `✓ Removed profile ${name} (store cleared)`);
+                return;
             }
-            (0, config_1.saveConfig)(config);
-            (0, output_1.outputJson)({ removed: name, active_profile: config.active_profile }, json, `✓ Removed profile ${name}`);
+            (0, context_1.saveRepoProfiles)(repoProfiles);
+            (0, output_1.outputJson)({ removed: name, active_profile: repoProfiles.activeProfile ?? null }, json, `✓ Removed profile ${name}`);
             return;
         }
         default:
@@ -205,3 +139,17 @@ function applyProfileFlags(profile, flags) {
         updated.default_ssh_key = flags['default-ssh-key'];
     return updated;
 }
+function resolveProfileName(repoProfiles, requestedName) {
+    if (requestedName)
+        return requestedName;
+    if (repoProfiles.activeProfile)
+        return repoProfiles.activeProfile;
+    const names = Object.keys(repoProfiles.profiles);
+    if (names.length === 0)
+        return undefined;
+    if (names.length === 1)
+        return names[0];
+    if (names.includes('default'))
+        return 'default';
+    return names[0];
+}

package/dist/index.js

@@ -47,9 +47,8 @@ async function main() {
         (0, help_1.showSubcommandHelp)(command, subcommand);
         return;
     }
-    const config = (0, config_1.loadConfig)();
     const credentials = (0, config_1.loadCredentials)();
-    const context = (0, context_1.resolveContext)(flags, config, credentials);
+    const context = (0, context_1.resolveContext)(flags, credentials);
     switch (command) {
         case 'org':
             await (0, org_1.handleOrg)(subcommand, rest, flags, context);
@@ -61,7 +60,7 @@ async function main() {
             await (0, job_1.handleJob)(subcommand, rest, flags, context);
             return;
         case 'profile':
-            (0, profile_1.handleProfile)(subcommand, rest, flags, config);
+            (0, profile_1.handleProfile)(subcommand, rest, flags);
             return;
         case 'auth':
             await (0, auth_1.handleAuth)(subcommand, flags, context, credentials);

package/dist/lib/client.js

@@ -110,7 +110,7 @@ async function attemptRefresh(context) {
         token_type: payload.token_type,
     };
     const credentials = (0, config_1.loadCredentials)();
-    credentials.profiles[context.profileName] = nextToken;
+    credentials.tokens[context.authKey] = nextToken;
     (0, config_1.saveCredentials)(credentials);
     return nextToken;
 }

package/dist/lib/config.js

@@ -1,16 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.loadConfig = loadConfig;
-exports.saveConfig = saveConfig;
 exports.loadCredentials = loadCredentials;
 exports.saveCredentials = saveCredentials;
-exports.getDefaultProfileName = getDefaultProfileName;
 const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
-const DEFAULT_PROFILE = 'default';
 const CONFIG_DIR = (0, node_path_1.join)((0, node_os_1.homedir)(), '.eve');
-const CONFIG_PATH = (0, node_path_1.join)(CONFIG_DIR, 'config.json');
 const CREDENTIALS_PATH = (0, node_path_1.join)(CONFIG_DIR, 'credentials.json');
 function ensureConfigDir() {
     if (!(0, node_fs_1.existsSync)(CONFIG_DIR)) {
@@ -40,37 +35,15 @@ function writeJsonFile(path, value) {
         // Best-effort for platforms that don't support chmod.
     }
 }
-function loadConfig() {
-    const fallback = { active_profile: DEFAULT_PROFILE, profiles: { [DEFAULT_PROFILE]: {} } };
-    const config = readJsonFile(CONFIG_PATH, fallback);
-    config.profiles = config.profiles ?? {};
-    if (!config.active_profile) {
-        const [first] = Object.keys(config.profiles);
-        config.active_profile = first ?? DEFAULT_PROFILE;
-    }
-    if (!config.profiles[config.active_profile]) {
-        config.profiles[config.active_profile] = {};
-    }
-    return config;
-}
-function saveConfig(config) {
-    config.profiles = config.profiles ?? {};
-    if (!config.active_profile) {
-        const [first] = Object.keys(config.profiles);
-        config.active_profile = first ?? DEFAULT_PROFILE;
-    }
-    writeJsonFile(CONFIG_PATH, config);
-}
 function loadCredentials() {
-    const fallback = { profiles: {} };
+    const fallback = { tokens: {} };
     const credentials = readJsonFile(CREDENTIALS_PATH, fallback);
+    credentials.tokens = credentials.tokens ?? {};
     credentials.profiles = credentials.profiles ?? {};
     return credentials;
 }
 function saveCredentials(credentials) {
+    credentials.tokens = credentials.tokens ?? {};
     credentials.profiles = credentials.profiles ?? {};
     writeJsonFile(CREDENTIALS_PATH, credentials);
 }
-function getDefaultProfileName(config) {
-    return config.active_profile ?? DEFAULT_PROFILE;
-}

package/dist/lib/context.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getRepoProfilePath = getRepoProfilePath;
-exports.loadRepoProfile = loadRepoProfile;
-exports.saveRepoProfile = saveRepoProfile;
+exports.loadRepoProfiles = loadRepoProfiles;
+exports.saveRepoProfiles = saveRepoProfiles;
 exports.removeRepoProfile = removeRepoProfile;
 exports.resolveContext = resolveContext;
 exports.parseHarnessSpec = parseHarnessSpec;
@@ -10,6 +10,7 @@ const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const yaml_1 = require("yaml");
 const args_1 = require("./args");
+const DEFAULT_PROFILE = 'default';
 // Default to Ingress URL for k8s stack (works via lvh.me → 127.0.0.1)
 // Override with EVE_API_URL for other environments (docker compose, local dev)
 const DEFAULT_API_URL = 'http://api.eve.lvh.me';
@@ -20,34 +21,37 @@ function getRepoProfilePath() {
     return (0, node_path_1.join)(process.cwd(), '.eve', 'profile.yaml');
 }
 /**
- * Load repository profile from .eve/profile.yaml if it exists
- * Returns null if file not found
+ * Load repository profiles from .eve/profile.yaml if it exists
  */
-function loadRepoProfile() {
+function loadRepoProfiles() {
     const profilePath = getRepoProfilePath();
     if (!(0, node_fs_1.existsSync)(profilePath)) {
-        return null;
+        return { profiles: {} };
     }
     try {
         const content = (0, node_fs_1.readFileSync)(profilePath, 'utf-8');
         const parsed = (0, yaml_1.parse)(content);
-        return parsed || null;
+        return normalizeRepoProfiles(parsed);
     }
     catch {
         // Silently ignore parse errors
-        return null;
+        return { profiles: {} };
     }
 }
 /**
- * Save repository profile to .eve/profile.yaml
+ * Save repository profiles to .eve/profile.yaml
  */
-function saveRepoProfile(repoProfile) {
+function saveRepoProfiles(repoProfiles) {
     const profilePath = getRepoProfilePath();
     const dir = (0, node_path_1.dirname)(profilePath);
     if (!(0, node_fs_1.existsSync)(dir)) {
         (0, node_fs_1.mkdirSync)(dir, { recursive: true });
     }
-    (0, node_fs_1.writeFileSync)(profilePath, (0, yaml_1.stringify)(repoProfile));
+    const payload = {
+        active_profile: repoProfiles.activeProfile,
+        profiles: repoProfiles.profiles,
+    };
+    (0, node_fs_1.writeFileSync)(profilePath, (0, yaml_1.stringify)(payload));
 }
 /**
  * Remove repository profile file
@@ -60,15 +64,16 @@ function removeRepoProfile() {
     (0, node_fs_1.unlinkSync)(profilePath);
     return true;
 }
-function resolveContext(flags, config, credentials) {
-    const repoProfile = loadRepoProfile();
+function resolveContext(flags, credentials) {
+    const repoProfiles = loadRepoProfiles();
+    const profileNames = Object.keys(repoProfiles.profiles);
     // Determine profile name and source
-    // Priority: flag > env > local (.eve/profile.yaml) > global active
+    // Priority: flag > env > local (.eve/profile.yaml) > default
     let profileName;
     let profileSource;
     const flagProfile = (0, args_1.getStringFlag)(flags, ['profile']);
     const envProfile = process.env.EVE_PROFILE;
-    const localProfile = repoProfile?.profile;
+    const localProfile = repoProfiles.activeProfile;
     if (flagProfile) {
         profileName = flagProfile;
         profileSource = 'flag';
@@ -81,34 +86,43 @@ function resolveContext(flags, config, credentials) {
         profileName = localProfile;
         profileSource = 'local';
     }
+    else if (profileNames.length === 1) {
+        profileName = profileNames[0];
+        profileSource = 'local';
+    }
+    else if (profileNames.includes(DEFAULT_PROFILE)) {
+        profileName = DEFAULT_PROFILE;
+        profileSource = 'local';
+    }
+    else if (profileNames.length > 0) {
+        profileName = profileNames[0];
+        profileSource = 'local';
+    }
     else {
-        profileName = config.active_profile || 'default';
-        profileSource = 'global';
+        profileName = DEFAULT_PROFILE;
+        profileSource = 'default';
     }
-    // Get base profile config from global profiles
-    const profile = config.profiles[profileName] ?? {};
-    // Apply overrides from repo profile on top of base profile
+    // Get base profile config from local profiles
+    const profile = repoProfiles.profiles[profileName] ?? {};
     const apiUrl = (0, args_1.getStringFlag)(flags, ['api', 'api-url']) ||
-        repoProfile?.api_url ||
         process.env.EVE_API_URL ||
         profile.api_url ||
         DEFAULT_API_URL;
     const orgId = (0, args_1.getStringFlag)(flags, ['org']) ||
-        repoProfile?.org_id ||
         process.env.EVE_ORG_ID ||
         profile.org_id;
     const projectId = (0, args_1.getStringFlag)(flags, ['project']) ||
-        repoProfile?.project_id ||
         process.env.EVE_PROJECT_ID ||
         profile.project_id;
-    // Credentials are always keyed by profile name (from global credentials file)
-    const tokenEntry = credentials.profiles[profileName];
+    const authKey = toAuthKey(apiUrl);
+    const tokenEntry = credentials.tokens[authKey] || credentials.profiles?.[profileName];
     return {
         apiUrl,
         orgId,
         projectId,
         profileName,
         profile,
+        authKey,
         token: tokenEntry?.access_token,
         refreshToken: tokenEntry?.refresh_token,
         expiresAt: tokenEntry?.expires_at,
@@ -126,3 +140,48 @@ function parseHarnessSpec(spec) {
         return [spec, undefined];
     return [spec.slice(0, colonIdx), spec.slice(colonIdx + 1) || undefined];
 }
+function normalizeRepoProfiles(parsed) {
+    if (!parsed || typeof parsed !== 'object') {
+        return { profiles: {} };
+    }
+    if (parsed.profiles && typeof parsed.profiles === 'object') {
+        return {
+            activeProfile: parsed.active_profile,
+            profiles: parsed.profiles,
+        };
+    }
+    const legacyConfig = extractProfileConfig(parsed);
+    const hasLegacyFields = Object.keys(legacyConfig).length > 0;
+    const legacyName = parsed.profile ?? parsed.active_profile;
+    if (!hasLegacyFields && !legacyName) {
+        return { profiles: {} };
+    }
+    const name = legacyName ?? DEFAULT_PROFILE;
+    return {
+        activeProfile: name,
+        profiles: { [name]: legacyConfig },
+    };
+}
+function extractProfileConfig(raw) {
+    const config = {};
+    if (raw.api_url)
+        config.api_url = raw.api_url;
+    if (raw.org_id)
+        config.org_id = raw.org_id;
+    if (raw.project_id)
+        config.project_id = raw.project_id;
+    if (raw.default_harness)
+        config.default_harness = raw.default_harness;
+    if (raw.supabase_url)
+        config.supabase_url = raw.supabase_url;
+    if (raw.supabase_anon_key)
+        config.supabase_anon_key = raw.supabase_anon_key;
+    if (raw.default_email)
+        config.default_email = raw.default_email;
+    if (raw.default_ssh_key)
+        config.default_ssh_key = raw.default_ssh_key;
+    return config;
+}
+function toAuthKey(apiUrl) {
+    return apiUrl.trim().replace(/\/+$/, '');
+}

package/dist/lib/git.js

@@ -0,0 +1,111 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isGitSha = isGitSha;
+exports.resolveGitRef = resolveGitRef;
+const node_child_process_1 = require("node:child_process");
+const node_path_1 = __importDefault(require("node:path"));
+const client_js_1 = require("./client.js");
+const GIT_SHA_REGEX = /^[0-9a-f]{40}$/;
+function isGitSha(ref) {
+    return GIT_SHA_REGEX.test(ref);
+}
+async function resolveGitRef(context, projectId, ref, repoDir) {
+    if (isGitSha(ref)) {
+        return ref;
+    }
+    const resolvedRepoDir = repoDir ?? getGitRoot();
+    if (!resolvedRepoDir) {
+        throw new Error(`Failed to resolve git ref '${ref}': not in a git repository.\n` +
+            'Run the command from the project repository, pass --repo-dir <path>, or use a 40-character SHA.');
+    }
+    if (projectId) {
+        const project = await (0, client_js_1.requestJson)(context, `/projects/${projectId}`);
+        const expected = normalizeRepoIdentity(project.repo_url);
+        const actual = normalizeRepoIdentity(getGitOriginUrl(resolvedRepoDir));
+        const repoDirIdentity = normalizeRepoIdentity(resolvedRepoDir);
+        if (expected && actual && expected !== actual) {
+            throw new Error(`Failed to resolve git ref '${ref}': current repo does not match project repo.\n` +
+                `  Project repo: ${project.repo_url}\n` +
+                `  Current repo: ${getGitOriginUrl(resolvedRepoDir)}\n` +
+                'Run the command from the project repository, pass --repo-dir <path>, or use a 40-character SHA.');
+        }
+        if (expected && !actual && (!repoDirIdentity || repoDirIdentity !== expected)) {
+            throw new Error(`Failed to resolve git ref '${ref}': current repo has no origin remote to validate against project repo.\n` +
+                `  Project repo: ${project.repo_url}\n` +
+                'Run the command from the project repository, pass --repo-dir <path>, or use a 40-character SHA.');
+        }
+    }
+    try {
+        return (0, node_child_process_1.execSync)(`git rev-parse ${ref}`, {
+            cwd: resolvedRepoDir,
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+    }
+    catch (error) {
+        throw new Error(`Failed to resolve git ref '${ref}': ${error instanceof Error ? error.message : String(error)}\n` +
+            'Make sure the ref exists in the repository, or use a 40-character SHA.');
+    }
+}
+function getGitRoot() {
+    try {
+        return (0, node_child_process_1.execSync)('git rev-parse --show-toplevel', {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+}
+function getGitOriginUrl(repoDir) {
+    try {
+        const url = (0, node_child_process_1.execSync)('git config --get remote.origin.url', {
+            cwd: repoDir,
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        }).trim();
+        return url || null;
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeRepoIdentity(repoUrl) {
+    if (!repoUrl) {
+        return null;
+    }
+    if (repoUrl.startsWith('file://')) {
+        return stripFilePath(node_path_1.default.resolve(repoUrl.replace('file://', '')));
+    }
+    if (repoUrl.startsWith('/') || repoUrl.startsWith('./') || repoUrl.startsWith('../')) {
+        return stripFilePath(node_path_1.default.resolve(repoUrl));
+    }
+    if (repoUrl.startsWith('git@')) {
+        const match = repoUrl.match(/^git@([^:]+):(.+)$/);
+        if (!match) {
+            return repoUrl;
+        }
+        const host = match[1].toLowerCase();
+        const pathname = stripGitSuffix(match[2]).toLowerCase();
+        return `${host}/${pathname}`;
+    }
+    try {
+        const parsed = new URL(repoUrl);
+        const host = parsed.host.toLowerCase();
+        const pathname = stripGitSuffix(parsed.pathname.replace(/^\//, '')).toLowerCase();
+        return `${host}/${pathname}`;
+    }
+    catch {
+        return repoUrl;
+    }
+}
+function stripGitSuffix(pathname) {
+    return pathname.replace(/\.git$/i, '');
+}
+function stripFilePath(filePath) {
+    return filePath.replace(/\.git$/i, '');
+}

package/dist/lib/help.js

@@ -529,12 +529,11 @@ Jobs default to 'ready' phase, making them immediately schedulable.`,
         examples: ['eve agents config --json'],
     },
     profile: {
-        description: `Manage CLI profiles. Profiles store defaults (API URL, org, project) so you don't
+        description: `Manage repo-local CLI profiles. Profiles store defaults (API URL, org, project) so you don't
 have to specify them on every command.
 
-By default, set and use write to .eve/profile.yaml (project-local). Use --global to
-write to ~/.eve/config.json instead. This lets you work on multiple projects without
-clobbering your global config.`,
+Profiles live in .eve/profile.yaml inside the repo, so each project keeps its own defaults
+and switching profiles won't affect other checkouts.`,
         usage: 'eve profile <subcommand> [options]',
         subcommands: {
             list: {
@@ -542,28 +541,26 @@ clobbering your global config.`,
                 usage: 'eve profile list',
             },
             show: {
-                description: 'Show profile details (local overrides applied)',
+                description: 'Show profile details',
                 usage: 'eve profile show [name]',
                 examples: ['eve profile show', 'eve profile show prod'],
             },
             use: {
-                description: 'Switch active profile (defaults to local .eve/profile.yaml)',
-                usage: 'eve profile use <name> [--global] [--org <id>] [--project <id>]',
+                description: 'Switch active profile (repo-local)',
+                usage: 'eve profile use <name> [--org <id>] [--project <id>]',
                 options: [
-                    '--global               Write to ~/.eve/config.json instead of local project',
                     '--org <id>             Set org override',
                     '--project <id>         Set project override',
                     '--api-url <url>        Set API URL override',
-                    '--clear                Remove local .eve/profile.yaml',
+                    '--clear                Remove local .eve/profile.yaml (clears all profiles)',
                 ],
                 examples: [
                     'eve profile use staging --org org_xxx --project proj_yyy',
-                    'eve profile use staging --global',
                     'eve profile use --clear',
                 ],
             },
             create: {
-                description: 'Create a new named profile (always global)',
+                description: 'Create a new named profile (repo-local)',
                 usage: 'eve profile create <name> [--api-url <url>] [--org <id>] [--project <id>]',
                 options: [
                     '--api-url <url>           API base URL',
@@ -581,16 +578,13 @@ clobbering your global config.`,
                 ],
             },
             set: {
-                description: 'Update profile settings (defaults to local .eve/profile.yaml)',
-                usage: 'eve profile set [name] [--org <id>] [--project <id>] [--global]',
+                description: 'Update profile settings (repo-local)',
+                usage: 'eve profile set [name] [--org <id>] [--project <id>]',
                 options: [
                     '--org <id>                Default organization ID',
                     '--project <id>            Default project ID',
                     '--api-url <url>           API base URL',
                     '--harness <name>          Default harness',
-                    '--global                  Write to ~/.eve/config.json instead of local project',
-                    '',
-                    'Global-only (require --global):',
                     '--supabase-url <url>      Supabase URL',
                     '--supabase-anon-key <key> Supabase anon key',
                     '--default-email <email>   Default email for auth login',
@@ -599,38 +593,40 @@ clobbering your global config.`,
                 examples: [
                     'eve profile set --org org_xxx --project proj_yyy',
                     'eve profile set staging --org org_xxx --project proj_yyy',
-                    'eve profile set --global --default-email user@example.com',
+                    'eve profile set --default-email user@example.com',
                 ],
             },
             remove: {
-                description: 'Remove a named profile (global)',
+                description: 'Remove a named profile (repo-local)',
                 usage: 'eve profile remove <name>',
             },
         },
         examples: [
             'eve profile set --org org_xxx --project proj_yyy     # writes .eve/profile.yaml',
             'eve profile use staging --org org_xxx                 # writes .eve/profile.yaml',
-            'eve profile set --global --default-email me@dev.com   # writes ~/.eve/config.json',
+            'eve profile set --default-email me@dev.com            # writes .eve/profile.yaml',
         ],
     },
     auth: {
         description: `Authenticate with Eve Horizon. Auth is optional for local development but required
-for cloud deployments. Credentials are stored per-profile.`,
+for cloud deployments. Credentials are stored globally per API URL.`,
         usage: 'eve auth <login|logout|status|whoami|bootstrap|sync|creds|token|mint>',
         subcommands: {
             login: {
                 description: 'Login via GitHub SSH challenge (default) or Supabase (legacy)',
-                usage: 'eve auth login [--email <email>] [--ssh-key <path>]',
+                usage: 'eve auth login [--email <email>] [--ssh-key <path>] [--ttl <days>]',
                 options: [
                     '--email <email>         Email address for SSH login (uses profile default_email if not provided)',
                     '--user-id <id>          User id for SSH login',
                     '--ssh-key <path>        Path to SSH private key (uses profile default_ssh_key, then ~/.ssh/id_ed25519)',
+                    '--ttl <days>            Token TTL in days (1-90, default: server configured)',
                     '--password <pass>       Supabase password (triggers Supabase login)',
                     '--supabase-url <url>    Supabase URL',
                     '--supabase-anon-key <key> Supabase anon key',
                 ],
                 examples: [
                     'eve auth login --email user@example.com',
+                    'eve auth login --email user@example.com --ttl 30',
                     'eve auth login  # uses profile defaults if set',
                     'eve auth login --ssh-key ~/.ssh/id_rsa',
                 ],
@@ -771,23 +767,24 @@ for cloud deployments. Credentials are stored per-profile.`,
             },
             deploy: {
                 description: 'Deploy to an environment',
-                usage: 'eve env deploy <env> --ref <sha> [--direct] [--inputs <json>] [--image-tag <tag>] [--project <id>]',
+                usage: 'eve env deploy <env> --ref <sha> [--direct] [--inputs <json>] [--image-tag <tag>] [--repo-dir <path>] [--project <id>]',
                 options: [
                     '<env>                  Environment name (staging, production, test)',
-                    '--ref <sha>            Git SHA or commit reference (required)',
+                    '--ref <sha>            Git SHA (required). Non-SHA refs resolve against the repo in --repo-dir or cwd.',
                     '--direct               Bypass pipeline and do direct deploy',
                     '--inputs <json>        JSON inputs for the deployment (e.g., \'{"release_id":"rel_xxx"}\')',
                     '--image-tag <tag>      Use a specific image tag for deploy (direct only)',
+                    '--repo-dir <path>      Resolve --ref against this repo instead of cwd',
                     '--project <id>         Project ID or slug (uses profile default if omitted)',
                     '--watch                Poll deployment status until ready (default: true)',
                     '--timeout <seconds>    Watch timeout in seconds (default: 120)',
                 ],
                 examples: [
-                    'eve env deploy staging --ref abc123',
-                    'eve env deploy staging --ref abc123 --direct',
-                    'eve env deploy staging --ref abc123 --inputs \'{"release_id":"rel_xxx","smoke_test":false}\'',
-                    'eve env deploy staging --ref abc123 --direct --inputs \'{"release_id":"rel_xxx"}\'',
-                    'eve env deploy staging --ref abc123 --direct --image-tag demo-abc123',
+                    'eve env deploy staging --ref 0123456789abcdef0123456789abcdef01234567',
+                    'eve env deploy staging --ref 0123456789abcdef0123456789abcdef01234567 --direct',
+                    'eve env deploy staging --ref 0123456789abcdef0123456789abcdef01234567 --inputs \'{"release_id":"rel_xxx","smoke_test":false}\'',
+                    'eve env deploy staging --ref 0123456789abcdef0123456789abcdef01234567 --direct --inputs \'{"release_id":"rel_xxx"}\'',
+                    'eve env deploy staging --ref main --repo-dir ./my-app',
                 ],
             },
             diagnose: {
@@ -952,19 +949,21 @@ for cloud deployments. Credentials are stored per-profile.`,
             },
             run: {
                 description: 'Run a pipeline',
-                usage: 'eve pipeline run <name> --ref <sha> [--env <env>] [--wait] [--only <step>]',
+                usage: 'eve pipeline run <name> --ref <sha> [--env <env>] [--repo-dir <path>] [--wait] [--only <step>]',
                 options: [
-                    '--ref <sha>          Git SHA or ref (required)',
+                    '--ref <sha>          Git SHA (required). Non-SHA refs resolve against the repo in --repo-dir or cwd.',
                     '--env <env>          Target environment',
                     '--project <id>       Project ID (uses profile default)',
                     '--wait               Wait for completion',
                     '--timeout <n>        Max wait time (seconds)',
                     '--inputs <json>      JSON inputs for the pipeline',
                     '--only <step>        Run a single step (includes dependencies)',
+                    '--repo-dir <path>    Resolve --ref against this repo instead of cwd',
                 ],
                 examples: [
-                    'eve pipeline run deploy-test --ref abc123 --env test',
-                    'eve pipeline run deploy-test --ref abc123 --env test --wait --timeout 120',
+                    'eve pipeline run deploy-test --ref 0123456789abcdef0123456789abcdef01234567 --env test',
+                    'eve pipeline run deploy-test --ref 0123456789abcdef0123456789abcdef01234567 --env test --wait --timeout 120',
+                    'eve pipeline run deploy-test --ref main --repo-dir ./my-app --env test',
                 ],
             },
             runs: {
@@ -1006,7 +1005,7 @@ for cloud deployments. Credentials are stored per-profile.`,
                 ],
             },
         },
-        examples: ['eve pipeline list', 'eve pipeline run deploy-test --ref abc123 --env test', 'eve pipeline logs deploy-test prun_xxx --follow'],
+        examples: ['eve pipeline list', 'eve pipeline run deploy-test --ref 0123456789abcdef0123456789abcdef01234567 --env test', 'eve pipeline logs deploy-test prun_xxx --follow'],
     },
     workflow: {
         description: 'Inspect workflows defined in the project manifest (read-only in Phase 1).',
@@ -1148,16 +1147,18 @@ for cloud deployments. Credentials are stored per-profile.`,
         subcommands: {
             create: {
                 description: 'Create a new build spec',
-                usage: 'eve build create --project <id> --ref <sha> --manifest-hash <hash> [--services <s1,s2>]',
+                usage: 'eve build create --project <id> --ref <sha> --manifest-hash <hash> [--services <s1,s2>] [--repo-dir <path>]',
                 options: [
                     '--project <id>       Project ID (uses profile default)',
-                    '--ref <sha>          Git SHA or commit reference (required)',
+                    '--ref <sha>          Git SHA (required). Non-SHA refs resolve against the repo in --repo-dir or cwd.',
                     '--manifest-hash <h>  Manifest hash (required)',
                     '--services <list>    Comma-separated service names to build',
+                    '--repo-dir <path>    Resolve --ref against this repo instead of cwd',
                 ],
                 examples: [
-                    'eve build create --ref abc123 --manifest-hash mfst_123',
-                    'eve build create --project proj_xxx --ref abc123 --manifest-hash mfst_123 --services api,web',
+                    'eve build create --ref 0123456789abcdef0123456789abcdef01234567 --manifest-hash mfst_123',
+                    'eve build create --project proj_xxx --ref 0123456789abcdef0123456789abcdef01234567 --manifest-hash mfst_123 --services api,web',
+                    'eve build create --project proj_xxx --ref main --repo-dir ./my-app --manifest-hash mfst_123',
                 ],
             },
             list: {
@@ -1232,7 +1233,7 @@ for cloud deployments. Credentials are stored per-profile.`,
             },
         },
         examples: [
-            'eve build create --ref abc123 --manifest-hash mfst_123 --services api,web',
+            'eve build create --ref 0123456789abcdef0123456789abcdef01234567 --manifest-hash mfst_123 --services api,web',
             'eve build list',
             'eve build show build_xxx',
             'eve build run build_xxx',
@@ -1274,7 +1275,7 @@ eve-new-project-setup skill to complete configuration.`,
         ],
     },
     system: {
-        description: 'System administration and health checks.',
+        description: 'System administration and health checks (admin scope required for most commands).',
         usage: 'eve system <subcommand> [options]',
         subcommands: {
             health: {
@@ -1283,7 +1284,7 @@ eve-new-project-setup skill to complete configuration.`,
                 examples: ['eve system health', 'eve system health --json'],
             },
             status: {
-                description: 'Show comprehensive system status (API, orchestrator, worker, queue)',
+                description: 'Show comprehensive system status (admin only)',
                 usage: 'eve system status',
                 examples: ['eve system status', 'eve system status --json'],
             },
@@ -1318,7 +1319,7 @@ eve-new-project-setup skill to complete configuration.`,
                 ],
             },
             logs: {
-                description: 'Fetch recent logs for a system service (api, orchestrator, worker, postgres)',
+                description: 'Fetch recent logs for a system service (admin only)',
                 usage: 'eve system logs <service> [--tail <n>]',
                 options: [
                     '--tail <n>          Number of log lines (default: 100)',
@@ -1329,12 +1330,12 @@ eve-new-project-setup skill to complete configuration.`,
                 ],
             },
             pods: {
-                description: 'List pods across the cluster (admin view)',
+                description: 'List pods across the cluster (admin only)',
                 usage: 'eve system pods',
                 examples: ['eve system pods'],
             },
             events: {
-                description: 'List recent cluster events (admin view)',
+                description: 'List recent cluster events (admin only)',
                 usage: 'eve system events [--limit <n>]',
                 options: [
                     '--limit <n>         Max number of events (default: 50)',
@@ -1415,7 +1416,7 @@ function showMainHelp() {
     console.log('Global options:');
     console.log('  --help               Show help for command');
     console.log('  --api-url <url>      Override API URL');
-    console.log('  --profile <name>     Use named profile');
+    console.log('  --profile <name>     Use named repo profile');
     console.log('  --org <id>           Override default org');
     console.log('  --project <id>       Override default project');
     console.log('  --json               Output as JSON');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eve-horizon/cli",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "Eve Horizon CLI",
   "license": "MIT",
   "repository": {